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Abstract 

The wing on the NASA F-lll transonic aircraft 
technology airplane was modified to provide flex- 
ible leading and trailing edge flaps. This wing 
is known as the mission adaptive wing (MAW) because 
aerodynamic efficiency can be maintained at all 
speeds. Unlike a conventional wing, the MAW has 
no spoilers, external flap hinges, or fairings to 
break the smooth contour. The leading edge flaps 
and three-segment trailing edge flaps are con- 
trolled by a redundant fly-by -wire control system 
that features a dual digital primary system archi- 
tecture providing roll and symmetric commands to 
the MAW control surfaces. A segregated analog 
backup system is provided in the event of a pri- 
mary system failure. This paper discusses the 
design, development, testing, qualification, and 
flight test experience of the MAW primary and 
backup flight control systems. 

Nomenclature 

AFTI advanced fighter technology integration 

A ICS airborne instrumentation computer system 

ADC analog-to-digital converter 

CCDU cross-channel display unit 

CLIN left inboard flap command 

CLLE left leading edge flap command 

CLMID left midspan flap command 

CLOUT left outboard flap command 

CRIN right inboard flap command 

CRLE right leading edge command 

CRMID right midspan command 

CROUT right outboard command 

CP command processer 

CPU central processing unit 

CRC cyclic redundancy characters 

CST combined systems test 

DAC digital -to-analog converter 

DDIU digital data interface unit 

EPROM erasable programmable read-only memory 
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FCEU flight control electronics unit 

FCS flight control system 

FMET failure modes and effects testing 

GRBK ground roll brake 

Hi MAT highly maneuverable aircraft technology 

INBD inboard flaps 

INTIN inboard flaps integrator command 

INTLE leading edge flaps integrator command 

INTMID midspan flaps integrator command 

INTOUT outboard flaps integrator command 

I/O input-output 

KR STICK roll stick gearing gain 

LE leading edge 

L!M limiter 

L/DT linear variable differential transducer 

LWD left wing down 

MAW mission adaptive wing 

MCP manual command program 

P primary hydraulic system 

PCM pulse-code modulation 

PDU power drive unit 

PiiO parallel input-output 

Pl.IN left inboard flap position 

PI.LE left leading edge flap position 

PI.MID left midspan flap position 

Pl.OUT left outboard flap position 

PF:IN right inboard flap position 

PFlLE right leading edge position 

PRMID right midspan position 

PROUT right outboard position 

PTDRIV preflight test driver 



QC impact pressure 

ROLCOM roll command 

ROM read-only memory 

R/T rol 1 ing tai 1 

RWD right wing down 

SDLC synchronous data link control 

SIO serial input-output 

SDC synchro-to-digital converter 

SYMCMD symmetric command 

TACT transonic aircraft technology 

TE trai 1 ing edge 

U utility hydraulic system 

AP differential hydraulic pressure 

between POUs of a given surface 

Introduction 

The aerodynamic design of today's high- 
performance aircraft is a compromise between con- 
flicting requirements. Performance requirements 
are generally formulated for a wide range of oper- 
ating conditions; however, a fixed airfoil is 
suitable only for a very limited range of flight 
conditions. One solution to this problem is the 
use of a variable-camber mission adaptive wing 
(MAW). The airfoil geometry of the MAW can be 
reconfigured in flight to improve aerodynamic per- 
formance throughout the flight envelope. Dramatic 
Improvements are predicted in payload range, 
maneuverability, and ride qualities. 

The National Aeronautics and Space Administra- 
tion (NASA) and the U. S. Air Force have estab- 
lished a joint advanced fighter technology inte- 
gration (AFTI) program to demonstrate the MAW 
technology. 1 The Boeing Military Aircraft Company 
was selected to modify the wing on the NASA F-lll 
transonic aircraft technology (TACT) research air- 
craft to incorporate flexible leading and trailing 
edge flaps. This airplane, known as the AFTI/ 
F-lll airplane (Fig. 1), is being flight tested 
by the NASA Ames Research Center at the Dryden 
Flight Research Facility. This vehicle was chosen 
because it afforded the best opportunity to 
investigate subsonic, transonic, and supersonic 
flight regimes for a wide range of wing sweeps 
(16° to 58°) and maneuvering conditions. 

The MAW features smooth, flexible, fiberglass 
panels for both the leading and trailing edge 
upper flap surfaces, as shown in Fig. 2. The 
lower surface panels form a sliding flush seal 
when the camber is set at the low-speed con- 
figuration. The flap drive mechanism is con- 
tained within the wing, so the smooth contour is 
not disturbed. The original TACT/F-111 wing box 
is a thin airfoil design; therefore, the internal 
flap drive incorporates rotary actuators, torque 
tubes, gear boxes, and hydraulic motors, as shown 
in Fig. 3. The thickness ratio for the MAW at a 


16° sweep is 9.7 percent at the root and 5.4 per- 
cent at the wingtip. 

This paper presents the design, development, 
and qualification of the MAW flight control sys- 
tems and subsequent flight test experience. 


AFTI /F-lll Airplane Modifications 


It was neccessary to modify the TACT/F-111 
airplane for the MAW features (Fig. 4), which 
include a single leading edge flap, three-segment 
trailing edge flap, two flight control electro- 
nics units (FCEU), interfaces to the original 
electrical and hydraulic systems, interfaces to 
certain original sensors, and new MAW sensors, 
cockpit panel, and battery. Details of the modi- 
fications are described in Ref. 2. 


The MAW flight control system (FCS) was added 
to control the MAW leading edge (LE) and trailing 
edge (TE) flaps. This system is isolated from the 
basic F-lll control system that controls the sta- 
bilon and rudder so that any problem developing 
from the MAW system will not affect the basic air- 
plane. The MAW FCEUs each consist of a primary 
and a backup FCS and servo drive electronics. The 
primary system features dual -channel digital com- 
puters. The LE and TE flaps can be trimmed sym- 
metrically. Also, the midspan and outboard flaps 
are used as rolling flaps to supplement the sta- 
bilon. The backup system is a dual-channel segre- 
gated analog system; it is designed as a "get-home" 
mode and does not have all the functions of the 
primary system. 


Separate primary and backup servo electronics 
receive a command from whichever system is con- 
trolling the flaps (primary or backup). Four 
types of signals can be generated to the valve at 
each power drive unit (PDU); proportional (com- 
mands), block, bypass, and brake. Internal servo 
electronics functions include the limiting of sur- 
face rate, surface position, and valve current as 
well as failure detection testing. 


MAW System Hardware Description 


The basic MAW flap actuation system consists 
of hydraulic motor, gear reduction box, electric 
brake, rotary actuator, control module, and 
torque tube. The motor, gear box, servo control 
valve, and brake are housed in the compact PDU 
module. The thin airfoil section of the TACT wing 
necessitated this compact arrangement. There are 
two PDUs for each of the eight MAW flaps. 


Primary System 

The primary MAW FCS architecture is shown in 
Fig. 5. The partitioning is structured so that 
each primary channel ideally provides one-half of 
the torque to drive a MAW flap. The numbers at 
each end of the flaps represent a PDU number, and 
P and U indicate primary or utility hydraulic sys- 
tem, respectively. Channel 1 and channel 2 com- 
mands are wired to the PDUs driven by the primary 
and utility hydraulic systems, respectively. 

Both FCEUs receive a dedicated differential pres- 
sure (AP) and flap position linear variable dif- 
ferential tranducer (LVDT) for each flap. The two 
primary computer servo commands are compared by 
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monitoring their AP torques at opposite ends of 
the same flap. The AP signal is generated by a 
hardware sensor that measures the hydraulic pres- 
sure for force fight between the PDUs on a given 
surface. If there Is a large force fight, the 
flaps cannot be driven with one channel, and the 
system would downmode to backup. In addition. If 
one of the primary computers should fail , the 
system would donwmode to backup. 

Force fights are minimized by the use of two 
equalization loops: position error and pressure. 

The position error loop provides identical actu- 
ating error signals to both servo amplifiers; 
these error signals are Introduced by unequal 
position commands or unequal position trans- 
ducer outputs, or both, within a 2.6° limit. 

The pressure equalization networks minimize 
the force fight between the two servo loops that 
arises because of the inherent servo valve driver 
amplifier offsets and the bias offset currents of 
the two servo valves. 

Backup System 

The backup PCS architecture Is different than 
the primary, as shown In Fig. 6. No control Is 
provided to the LE flaps from this system, because 
they are automatically braked. Backup system A 
drives both POUs of the left midspan and right 
outboard and the inner POUs of the Inboard flaps. 
Backup system B drives both POUs of the left out- 
board and right midspan and the outer PDUs of the 
inboard flaps. The backup system has its own 
dedicated LVDTs. Note that the roll flaps have 
only one backup LVDT per surface. If a single 
backup channel falls, the brakes would be set for 
those flaps, and the remaining backup system would 
continue to drive its dedicated flaps. 

Isolation of Primary and Backup Systems 

The primary and backup hardware components are 
generally Isolated from one another. For example, 
a MAW roll stick transducer was added to Isolate 
the MAW roll control from the basic F-lll FCS rol- 
ling tail and to provide Independent roll Inputs 
to the MAW primary and backup FCS. There are 
six MAW roll stick transducers (two primary and 
four backup). Each backup system receives two 
stick Inputs. Input discrete redundancy Includes 
four contacts; two of these discretes go to the 
primary system while a different set goes to each 
backup system. 

MAW Flight Control System Description 

The following sections provide a brief descrip- 
tion of the cockpit functions, primary FCS block 
diagram, backup FCS functions and downmode logic, 
and fault monitoring. 

MAW Cockpit Functions 

The pilot Interface to the control of the MAW 
flap surfaces is accomplished by the use of a flap 
switch, roll stick, control and display panel, 
wing sweep handle, and gun trigger switch. The 
MAW control and display panel is shown in Fig,, 7. 
This panel is used in conjunction with the roll 
stick and flap switch to control the various func- 
tions of the MAW flaps; the panel also conveys 
status Information and flap positions of the MAW 


system. Many of the lights and meters are color 
coded for quick backup partitioning reference. 

A detailed description of the primary MAW FCS is 
given in Ref. 3. A brief description of some 
of the manual MAW control functions follows. 

SYSTEM switch - selects primary or backup MAW FCS 

PR I FAILED RESET switch — resets the backup latch, 
which allows entry to the primary FCS 

MAW CAUTION light — flashes for downmodes or prob- 
lems in the backup system; can be reset 

QC FAIL light - lights if the impact pressure (QC) 
probes difference becomes too large; the FCS will 
fix the roll gain and TE deflection limits for 
this failure; can be reset if the difference is 
within the tolerance 

FLAPS lights - HALF, FULL, GND ROLL, and FAIRED 
lights Indicate the LE and TE flap command 
selection 

BACKUP RESET — various backup fault monitors will 
set these lights; monitors can be reset if the 
fault conditions have cleared 

Brake switches — switches are provided for the LE, 
A, INBD, and B MAW flap pairs for a manual brake 
engagement; manually braking any TE flaps will 
also cause a downmode to the backup system 

MANUAL COMMAND PROGRAM switch - LE and TE flaps 
can be positioned to preprogrammed positions by 
using the manual command program (MCP) function; 
used in conjunction with the 12-position selector 
switch 

RATE SELECT switch — allows symmetric slewing at 
three different rates: FAST (5 deg /sec ) , NORM 
(1 deg/sec), and SLOW (0.3 deg/sec) 

ROLL TRIM switch — used to command asymmetric trim 
for the MAW roll surfaces (midspan and outboard); 
it has a limited authority of ±2° about the sym- 
metric command 

TRIM RESET button — removes MAW roll trim 

INBD FAIR button — causes the inboard flaps to 
drive to a position of 1.8° when the sweep lever 
is at the 26° detent and the flap switch is In 
RETRACT 

Slew switches — manual symmetric trim capability 
is provided with the LE, ALL, INBD, MID, and OUTBD 
switches for the LE and TE flaps 

PREFLIGHT TEST switch - a MAW preflight test pro- 
gram can be executed only on the ground; this is 
an automated function to test the force fight 
monitors, the LE brake hardware latch, and the 
backup system hardware latch 

Flap switch — a MAW flap switch located on the 
front cockpit panel can command the LE and TE 
flaps to three camber configurations: RETRACT 

(5°/2°), HALF (15°/10°), and FULL (20°/18°) 

Home command — gun trigger switch on either stick 
is used to command the LE and TE flaps to 0° and 
2°, respectively 
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Digital Primary Control System 

The digital primary control system is designed 
to manually trim the LE and TE flaps symmetrically 
and to compensate for the roll control loss due to 
the removal of the spoilers from the TACT wing. 
Figure 8 is a simplified block diagram of the MAW 
control system showing the roll and symmetric com- 
mands. Impact pressure (QC) signals from the nose 
boom (QC NOSE ) and fuselage side probes (QCSIDE) 
are filtered to reduce noise and then averaged 
(yielding QCAVE) for use in scheduling the roll 
stick gearing gain (KRSTICK). A lead-lag filter 
is used in the stick input path (ROLLSTK) to 
quicken the roll response for the takeoff and land 
configuration. The roll gain (RGAIN) of 1.95 pro- 
vides 18.5° of MAW roll authority. 


The roll command (ROLCOM) is derived by sum- 
ming the roll command from the stick with the roll 
trim (RWD trim or LWD trim). The MAW trim has a 
±2° limit about the trim point. Trim commands 
are faded out either by pressing the trim reset 
switch (TRIM RES) or whenever the system goes to 
the backup mode. 

Symmetric commands are’ derived by integrating 
the various ways of commanding symmetric flap 
motion. The symmetric slew discretes are shown 
in order of priority from left to right. The 
manual command program (MCP) has the lowest pri- 
ority, the inboard flap fairing command (FAIR) 
has the highest. 

The roll flap servo commands are derived by 
summing ROLCOM with the integrator inputs (INTMID 
and INTOUT). The TE flap deflection limits are 
scheduled with QC and are rate limited. The 
midspan and outboard flaps are rate limited at 
40 deg/sec, the inboard flaps at 30 deg/sec, and 
the leading flaps at 10 deg/sec. The primary com- 
mands track the positions whenever the system is 
in backup. For a transfer from backup to the pri- 
mary system, the commands are faded from the pre- 
sent flap position to the new updated primary 
commands in 2 sec. 

Analog Backup Control System 

The backup system can symmetrically position 
the TE flaps in three positions only, and there is 
no trimming capability. There is no control of 
the LE flaps; they are automatically braked. The 
TE flap rate and authority limits are the same as 
those in the primary system. Additional functions 
provided in the backup system are the ability to 
set A, INBD, or B trailing edge flap pairs. The 
system is partitioned into independent A and B 
analog controllers. This design allows for par- 
tial control after the failure of one of the 
backup channels. Details of the backup FCS are 
described in Ref. 4. 

Transition logic is designed to suppress the 
flap command switching transients when the control 
is transferred from primary to backup. This is 
accomplished by driving first-order filters with 
the current flap positions. An example for a 
single surface is shown in Fig. 9. When control 
is transferred to the backup system, the outputs 
of these filters are switched so that they are 


connected to the summing junctions to provide the 
initial flap command. The initial roll command 
(ROLLCMD) and symmetric command (SYMCMD) are zero 
immediately after switching to the backup control. 
They are then faded to their requested values by 
4-sec time-constant filters. 

Fault Monitoring 

Fault checking is performed continuously in 
both the primary and the backup FCS, so the pilot 
and ground observers know the health of the total 
MAW FCS, The pilot can reset a backup failure 
monitor while still flying in the primary system. 
If the system d'ownmodes to backup with an existing 
monitor fault, the brakes will be automatically 
set on the faulty system. 

Failure monitoring can be divided into those 
failures originating in either the primary or the 
backup systems. Primary system failures can be 
grouped into two categories: (1) stay in primary 

and (2) downmode to backup. The backup system 
failures can also be grouped into two categories: 
(1) do not set brakes, and (2) set any combination 
of A, B, or INBD brakes. These general failures 
are shown in Table 1. Each type of fault has its 
own distinct fail discrete. These fail flags are 
available in the cross-channel data and are tele- 
metered to the ground station. 

The primary FCS is designed to prevent a MAW 
surface hardover. If a single command disagree- 
ment between the two .channels exists, the fault 
monitor will generate a downmode. The downmode 
could be the result of a software command error 
or an excessive AP. It is conceivable that a 
hardover could be possible while the backup sys- 
tem is engaged, but this would require the loss 
of a backup feedback signal in the servo elec- 
tronics (that is, a frozen or open backup LVDT). 
However, if the flaps are in RETRACT, fault 
detection testing would cause the brakes to be 
automatically set. The worst-case flap offset 
would be less than 12°. Single and double flap 
runaways have been studied extensively in the 
simulator; they are easily controlled with 
opposite roll stick. 

Flight System Development 

The MAW flight system development progressed 
in several stages. A design was developed that 
satisfied both mission research requirements and 
safety of flight. A dual digital primary and seg- 
regated analog backup FCS evolved. The program- 
ming task was evaluated, and the Zilog Z8000 CPU 
was selected. Future software and hardware expan- 
sion was allowed for in the design. Six flight 
computers based on the Z8000 CPU were designed and 
built for the AFTI/F-111. The cross-channel data 
communications utilized a Z80 chip. Specification 
documents were developed for both the primary^ and 
the backup systems. 4 

Simulation Development 

A piloted simulation was used extensively to 
develop and assess the MAW control system design. 
The MAW FCS software structure for the simulation 
was programmed in FORTRAN using the flow charts 
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found in the software design description docu- 
ment. 5 The information found in Refs. 3 and 4 was 
also used. During this effort some logic errors 
and design deficiencies were discovered and cor- 
rected before any flight code was generated. A 
software version for the simulation of the backup 
system was also interfaced with the simulation. 
Fault detection and downmode logic was structured 
for the simulation to reflect the flight system as 
much as possible. A set of possible failure modes 
was developed for pilot training and assessment of 
the FCS design. The failure input modes for the 
simulation are shown In Table 2. 

The simulation revealed a pilot-induced oscil- 
lation tendency in the landing approach, particu- 
larly in turbulence and crosswind conditions. A 
lead-lag filter (Fig. 8) was added for the power 
approach condition, and the rolling flap rate limit 
had to be increased from 30 to 40 deg/sec to alle- 
viate this problem. The roll rate increase was 
accomplished by a linkage change in the flap 
drive mechanism. 

Hardware Acceptance Tests 

The Individual hardware components for both 
primary and backup FCEUs were tested in each box 
separately according to the procedures outlined 
in Ref. 6. Primary system hardware was tested by 
temporarily cross-connecting input-output (I/O) to 
itself. All the discrete converters, analog-to- 
digital , digital -to-anal og , and synchro-to-digital 
converters (DAC , ADC, and SDC, respectively), were 
tested in this manner. The backup system func- 
tions, such as filters, limiters, and gain sched- 
ulers, were tested by temporarily connecting to 
the primary I/O. The primary I/O was driven by 
a microcomputer that contained the semiautomatic 
test programs. The test programs contained oper- 
ator and primary FCEU I/O instructions with built 
in pass-fail criteria. Hard copies of the test 
results were obtained for all the FCEUs. 

Flight Software Development 

The flight software code was written in 
assembly language from flow charts that were 
developed from Ref. 3. Figure 10 gives an 
overview of the software structure. 

The two FCEUs are synchronized to assure that 
the difference between the start times of their 
minor cycles is less than 70 usee. The two proc- 
essors exchange a sync message through the com- 
munication channel. The elapsed time between 
sending a sync message and receiving the other 
processor's sync message is measured; since the 
actual transmission time is known, it can be 
determined which processor is lagging. The faster 
processor adjusts the count in its timer to syn- 
chronize with the slower unit. 

The input module commands the hardware ADC 
and SDC to perform their conversion and then 
reads a 12-bit value for each. This module then 
converts these quantities to a two's complement, 
two-byte fixed-point word in engineering units 
for use by the other modules. The discrete bytes 
are unpacked and debounced so that the third 
consecutive one in a string is recognized as a 
state change. 


The surface position annunciator module tests 
the MAW surface positions against several standard 
configurations and sends output discretes for lamp 
drivers to the MAW panel (HALF, FULL, GND ROLL, 
and FAIRED lights) . 

The mode logic module generates two discretes 
that are used by the servo command and command 
integrator modules to cause the execution of ini- 
tialization routines. The conditions for setting 
one or both discretes are (1) returning from 
backup to the primary system, (2) resetting the 
leading edge brake, and (3) computer power-up. 

The command module generates symmetric command 
input rates to the integrators in the command inte- 
grator module. 

The preflight test module generates a force 
fight for each of the MAW flaps by commanding a 
bias in one channel only. The AP hardware moni- 
tors trigger a fault discrete after the threshold 
is exceeded. The LE and backup hardware latches 
are also tested. 

The Z8000 communications module exchanges 
data between the two FCEUs through the cross- 
channel data message for comparison purposes in 
failure detection. Each command processor (CP) 
has one Z8000 and one Z80 processor running in 
parallel and communicating with each other through 
two parallel input-output (PIO) devices, as shown 
in Fig. 11. The Z8000 processes commands and sen- 
sor inputs during each minor cycle and stores the 
developed data in a buffer (M2) that is shared 
with the Z80 by a handshake procedure through the 
PIOs. The Z80 copies this buffer into its dedi- 
cated memory (Ml) while the Z8000 also copies this 
buffer into its dedicated memory (M3) for use in 
the next iteration for comparison (by the failure 
detection module) with the data transmitted by the 
other CP. The Z8000 then continues processing new 
input while the Z80 starts feeding the transferred 
data at 180 kbits/sec to one channel of a serial 
input-output (SIO) data link for transmission to 
the other CP, while simultaneously receiving data 
transmitted by the other CP through the SIO. 

The format of the transmitted message is de- 
rived from the IBM synchronous data link control 
(SDLC) convention. The address field is used 
by the receiver to verify that the message is 
intended for it. Each of the Cyclic Redundancy 
Characters (CRCs) consists of eight redundancy 
bits generated by the SIO upon transmission and 
verified upon reception. 

The roll module calculates a roll command from 
roll stick and MAW trim inputs. This command is 
added antisymmetrically in the servo command mod- 
ule to the symmetric commands of the outboard and. 
midspan flaps. 

The command integrator module integrates the 
rate commands that are input to it from the com- 
mand module to form position commands. These 
commands are sent to the servo command module. 

The failure detection module performs the fol- 
lowing functions; (1) compares all analog and 
selected discrete inputs and outputs of the local 
channel with those of the other channel; (2) com- 
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pares POU differential pressures for each MAW sur- 
face of the local channel with those of the other 
channel; (3) compares the left and right LE posi- 
tions; (4) compares each MAW flap position with an 
ideal model; and (5) declares and logs failures 
when the comparisons exceed difference thresholds 
or when failure signaling discretes have been set 
by other modules. 

The built-in test module does an ongoing 
check sum test of read-only memory (ROM) while 
waiting for the real-time clock to signal the end 
of a 20-msec minor cycle. 

The servo command module combines the position 
commands for all MAW surfaces from the command 
integrator module, the preflight test module, and 
the roll module. The roll module commands are 
summed only with the midspan and outboard flaps. 

The commands are also rate and position limited. 

The output module converts and scales the out- 
put variables of the servo command module from 
their Internal digital format to a nonlinear DAC 
voltage command to compensate for LVDT linkage. 

This is done by computing an index from the com- 
mand for looking up in a table. 

Flight Software Testing 

The flight software was tested in four phases: 
(1) individual module tests, (2) intermodule tests, 
(3) hot-bench open-loop tests, and (4) integrated 
airplane systems tests. The first two phases 
were done in a non-real -time batch mode that used 
a Z8000 simulator computer; in the second two 
phases the software was running in the actual 
flight hardware computers. 

The individual modules were coded by a program- 
mer from flow charts that were developed from the 
software specification. The software verifier 
developed a flow chart from the code and compared 
this with the original flow chart for similarity. 
The I/O and all possible logic branches were tested 
by adding a loop around the function being tested 
to simulate a real-time execution. The contents 
of pertinent registers were printed for each 
Iteration and compared with the expected values. 

The Intermodule tests checked the interface 
between the modules. The output of one module is 
used as an input to another. The entire set of 
modules was eventually integrated in this manner. 

The hot-bench testing utilized the actual 
flight computers for the software verification. 7 
The FCEUs were connected to a control panel that 
simulated the aircraft sensor interface. This was 
an open-loop system because the LVDT feedback 
signals were generated from hand pots. The test 
setup is shown In Fig. 12. The control and dis- 
play panel and the aircraft sensors were wired to 
a control patch panel. This allowed the signals 
to be opened for checkout and fault tasting. The 
MAW servo commands and other signals were hard- 
wired to strip chart recorders. Also, a cross- 
channel display unit (CCDU) was used to access 
the cross-channel data message. 

The CCDU is microprocessor-based ground sup- 
port equipment that was developed specifically for 


the AFTI/F-111 program. The experience of using 
an earlier version of the CCDU on the highly 
maneuverable aircraft technology (Hi MAT) pro- 
gram 8 prompted the decision to develop one for 
this program. The CCDU displays the digital data 
message in an engineering unit format on a CRT 
or sends signals out to 16 DACs for strip chart 
recordings. Basically, the CCDU maps the cross- 
channel data message from each computer into its 
own internal memory address. The data are then 
referenced symbolically by the use of a symbol 
table that divides the message into mnemonic names 
and byte lengths. The discrete bytes are unpacked 
for convenient user-oriented data displays. Hard 
copies of any CRT data display can also be made 
on a line printer. The structure of the cross- 
channel message is shown in Table 3. 

The CCDU proved to be a valuable tool in 
debugging problems and verifying the software in 
general. Even if a desired byte or bytes were not 
on the cross-channel message, a temporary change 
to the message could be made without making a new 
erasable programmable ROM (EPROM). This change 
would be made by stopping an FCEU from the ter- 
minal and entering the addresses of the desired 
bytes (up to 18) in the WINDAT portion of the 
message. After both FCEU messages have been 
modified, they are started again in the real- 
time run mode. The default WINDAT addresses 
remain overwritten until the power on the FCEUs 
is cycled. The CCDU operator can redefine data 
lengths in the WINDAT portion of the symbol table 
if necessary and then make any data type changes 
on the CRT displays. 

Flight Qualification 

The flight qualification tests were done on 
the airplane as a total integrated system. These 
tests were done in two phases: (1) testing per- 
formed in the hangar and (2) engine run tests. 

The hangar testing used an external hydraulic 
supply system that did not have the flow rate 
capability of the engine pumps. 

Hangar testing 

The test setup for the hangar testing is 
depicted Fig. 13. Three means of testing and 
trouble shooting the FCEUs were utilized: the 

CCDU, breakout boxes, and extender cards. The 
CCDU provided read-only access of each FCEU cross- 
channel data message in user display formats. 

This provided a versatile tool during the qualifi- 
cation tests and for trouble shooting problems. 
Breakout boxes, required for certain types of 
testing, were inserted between the aircraft I/O 
connections and the FCEUs. Access to the external 
FCEU I/O signals was accomplished through these 
boxes. These boxes were utilized to monitor, 
open, and insert voltages for the failing modes 
and effects testing (FMET) and for trouble- 
shooting test modes. Extender cards were used 
as a last resort because they involved opening 
an FCEU box, removing the desired card, and put- 
ting it on an extender. 

A detailed test plan procedure 8 was devel- 
oped for these systems tests. The major tests 
are listed in Table 4. During the process of 
performing these tests a number of hardware and 
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software anomalies and design errors were dis- 
covered. They were not discovered earlier, be- 
cause the FCEUs had never been interfaced with 
a real aircraft system. A number of changes to 
the MAW FCS hardware and software were made to 
correct the anomalies. The piloted simulation 
was used to test any proposed FCEU changes that 
might affect the flying qualities. 

Engine runs 

The engine run tests provided a total func- 
tional check of the system in the real environment 
of actual hydraulic and electrical power generated 
from the engines. One of the major tests was to 
determine during what conditions the hydraulic 
capability was marginal. Continued stick cycling, 
particularly for single-engine operation, showed 
less than desirable safety margins. Also, fault 
monitors in both the primary and backup MAW FCS 
were set because of the slower flap rates. Fur- 
ther hardware and software changes were made to 
improve the flap positions predictor and to dis- 
able the downmode logic for critical flap posi- 
tions during landing. The hydraulic pump flow 
rate capacities were also upgraded by 10 percent. 

Real-Time Monitoring 

The AFTI/F-111 airplane is extensively instru- 
mented. The signals are recorded in pulse code 
modulation (PCM) format to an on-board tape and 
are also telemetered to a ground station for real- 
time monitoring,. A portion of the FCEU cross- 
channel message (78 bytes) is interfaced with the 
PCM instrumentation system through a digital data 
Interface unit (DDIU) and an airborne instrumenta- 
tion computer system (AICS). The DDIU^ receives 
serial data streams at 50 samples/sec from each 
FCEU. The ODIU transmits a 16-bit parallel data 
word composed of 8 bits of label (HI byte) and 
8 bits of data (L0 byte). The AICS is programmed 
to test for a particular label byte followed by 
its data byte. If the data are coming in too fast 
or if the label bytes are not in ascending order, 
fault flags are issued on the PCM downlink. 

The control room real-time monitoring includes 
the various types of CRT displays (color panel, 
color graphics, and data). A number of strip 
charts are also used. The color panel display 
that shows the MAW status and faults is shown in 
Fig. 14„ The color panel is used to display the 
following types of information: 

1. Annunciator lights of the MAW control and 

display panel 

2. Error flags from each FCEU 

3. Indicators that signify "good" data are 

being received 

4. Certain airplane system status information 

that affects safety of flight 

5. Automatic piloted procedure requests 

depending on particular fault conditions 

6. Wing sweep fault testing 

7. Preflight test counter information 

Latches are created in the control room com- 
puter on any faults that would cause a backup 
downmode or set a status light. The intent is 
to determine immediately the cause of any problem. 
An audio cue (three tones) is provided in the con- 


trol room whenever the MAW CAUTION light starts to 
flash. The fault latch is dropped when the pilot 
resets the MAW CAUTION light or when the FCS engi- 
neer resets the latch flag using a keyboard in the 
control room. 

The real-time software verification testing 
was done in three phases: (1) external signal 
simulation into the ground station computer; (2) 
generation of real PCM signals by hard-wiring to 
the airplane from the hangar; and (3) actual tele- 
metry transmission from the airplane at the engine 
run area for combined systems tests (CST). The 
first phase tested the driver logic for the real- 
time displays, while the second phase tested the 
PCM interface to the computer. The third phase 
tested the path from the airplane antenna to the 
ground station receiver to the computer interface 
and also tested for any signal interference during 
the data transmission. 

Flight Test Experience 

Most of the MAW FCS signals are available on 
the telemetry downlink, thus providing the capa- 
bility of making real-time judgments based on this 
information. A MAW system failure decision tree 
(Fig. 15) was developed to establish procedures in 
the event of MAW problems during flight. Basi- 
cally, the pilot wants a simple procedure for any 
MAW failure indication; the established procedure 
is to brake all the MAW flaps in their current 
position and await Instructions from the ground 
station. The flight controls engineer can deter- 
mine the nature of the anomaly from the MAW status 
and faults color panel and other displays and then 
advise the pilot to release the brakes and to 
attempt to reset the failure or to land with the 
MAW flaps braked and use only the stabilons for 
roll control. 

To date, there have been a total of four 
flights of the AFTI/F-111 MAW aircraft. The MAW 
FCS has been fully engaged for all takeoffs and 
landings. Most of the MAW primary FCS functions 
have been demonstrated in flight. Also, the MAW 
backup FCS has been manually engaged at altitude 
for piloted evaluations; it has performed very 
well. All the MAW flaps have been manually braked 
for tail-only roll control evaluation. In this 
configuration the airplane is expected to be rela- 
tively easy to land in the absence of other fail- 
ures or excessive crosswinds. 

An anomaly occurred after the second flight: 
The airplane failed to pass the automated MAW pre- 
flight test program function. Very rapid analysis 
of the problem using the CCDU and breakout boxes 
traced the problem to PDU number 4, which is on 
the right outboard side of the right LE flap (see 
to Fig. 5). Inspection of the PDU revealed that 
it was uncoupled because of a sheared mechanical 
fuse link in the shaft between the motor and the 
gear box. All the LE PDU motor shafts were 
inspected and replaced. 

One of the brakes in the left leading edge 
flap occasionally failed to release properly 
during ground test. A workaround procedure was 
developed for the first two flights. Both left 
LE brakes were replaced after the second flight. 
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During the third flight a hydraulic leak 
occurred in the F-lll utility system, which 
caused the flight to be terminated early. The 
airplane was landed without incident using the 
primary MAW FCS. 

Concluding Remarks 

The MAW FCS design development grew in scope 
and complexity from the original concept. The 
foremost consideration was flight safety, which 
required redundancy In both the primary and the 
backup systems. The second design consideration 
was the mission requirements. The lessons learned 
during the development process are outlined below. 

1. The initial MAW design was tested early 
using pi 1 ot-in-the-loop simulations before any 
hardware procurements were initiated. This early 
assessment allowed changes to be made during iter- 
ations of the design process before concepts were 
frozen and changes became expensive. 

2. The MAW FCS design allowed for hardware 
and software expansion, which was necessary to 
allow for modifications during the development 
and flight qualification process. 

3. The simulation program was coded directly 
from the flight specification document. Errors in 
the software logic were found early and corrected, 
which saved time by eliminating these errors prior 
to the generation of flight software, 

4. The thorough ground testing process proved 
to be an important element in finding and ulti- 
mately correcting anomalies so that the airplane 
could be qualified for flight test. 

5. The sensors, commands, fail flags, and 
I/O discretes, which were made accessable to the 
engineers through the cross-channel data message, 
proved very valuable in the FMET, trouble shooting 
test modes, and real-time monitoring during flight 
test. The problems most difficult to solve were 
those that Involved data that were not on this bus. 

6. The design of the MAW system made it 
easier to test and troubleshoot the system 
because of easy access to signals on the cross- 
channel data bus and hard-wired test points on 
the component cards back plane. 

7. The decision to develop ground testing 
tools, particularly the CCDU and breakout boxes, 
before problems occurred saved considerable time 
and money in identifying problems during the 
flight qualification process. 


8. Adding the DDIU so that the MAW cross- 
channel message was available by downlinking 
through the instrumentation system proved to be 
very important. This provided real-time moni- 
toring capability of the MAW FCS and the estab- 
lishment of piloted procedures based on the data 
analysis from the control room. 
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Table 1 Fault detection 


Primary failures 

Failures not causing downmode 

Failures causing downmode to backup 

Any LE failure (system will set LE brakes) 

QC probe (system will set fixed roll gain and TE limit) 
Ideal model (LE and roll flaps) 

Command (except LE) 

Selected output discretes 

Ideal model (inboard flaps only) 

AP 

Stick 

Power supply 

Hydraulic pressure <1200 lb/in 2 
Computer executive error 
Watch dog timer 

Backup failures 

«•»* « « *« Fa ''“ res o c r“ro 9 t s,sT^f;:; of *• 

A1 iveness monitor 

QC (system will set fixed roll gain and TE limit) 

Single hydraulics 

Ideal model (flaps HALF/FULL) 

Valve current 
Position limit 
Power supply 
Stick 

Ideal model (flaps RETRACT) 


Table 2 Simulation system 
failure inputs 


MAW A flap roll hardover to the left 

MAW A flap roll hardover to the right 

MAW B flap roll hardover to the left 

MAW B flap roll hardover to the right 

Left LE brake set 
QC fail 

Single hydraulic system fail 

Inboard flap fairing fault 

Pitch damper fail 

Roll damper fail 

Yaw damper fail 

a 3° LE differential fail 

A backup reset monitor 

B backup reset monitor 

INBO backup reset monitor 

Engine fail 

Downmode to backup 

IDENT fault (roll reversal) 

Model fault threshold 


Table 3 Cross-channel data message 


Si gnal s 

Length, bytes 

FLAG 

1 

ADDRESS 

1 

CONTROL 

1 

FRAME COUNT 

4 

ERROR FLAGS 

10 

INPUT DISCRETES 

14 

OUTPUT DISCRETES 

8 

D/A OUTPUTS 

24 

WINDAT 

18 

ANALOG INPUTS 

94 
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Table 4 Qualification tests 


Test prerequisites 

Failure modes and effects testing 

Continuity check of MAW FCS wiring 

Hydraul ic 

Voltage check of MAW FCS wiring 

El ectrical 

Test equipment calibration 

Brake 

Flap calibration 

LE differential 


Position 

MAW flight control system tests 

AP 

Control and display panel lamp checks 

Input discrete 

Backup FCS validation 

Output discrete 

Primary-Backup transitions 


MAW brake engagements 

Hysteresis tests 

PDU bypass, block, brake 


Hydraulic bypass interlock 

Dynamic response tests 

MAW electrical system tests 

DD1U tests 

MAW battery operation time 


Reduced voltage operation 

Piloted evaluations 

Flap switch effects on the basic F-lll FCS 

Engine runs 


Combined system tests 



ECN 33205-011 


Fig. 1 AFTI/F -111 aircraft. 
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NOTES: (1) The signal flow is a two-way path; (2) No. - PDU number 

from FCEU - commands (3) P - primary hydraulics 
to FCEU - AP, LVDT s U - utility hydraulics 

Fig . 5 System architecture of digital primary FCS. 
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to FCEU - AP. LVDTs U - utility hydraulics 

Fig. 6 System architecture of analog backup FCS. 
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Fig. 7 MAW control and display panel. 
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Fig. 8 simplified block diagram of HAW cornnands . 
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Fig. 9 Backup command fade-in - 
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Fig. 10 Software module structure. 
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Fig. 15 MAW 8 yetem failure decision tree. 
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